I am an independent author and researcher producing plain-English analysis of AI governance, accountability and geopolitical risk for businesses outside the technology industry. My work examines how decisions made by governments and technology companies affect the benefits businesses gain from AI, their control over its use and the ability to keep operating when services change or fail.
AI can help businesses save time, improve access to information and deliver better services. Understanding those benefits also means examining the information AI can access, the authority it is given and whether safeguards work in practice. My research distinguishes claims about protection from evidence that businesses can check, with a focus on practical questions:
Government policy, commercial interests and international relationships influence access to AI services and the infrastructure behind them. My writing explores how dependencies on overseas providers affect business continuity, who sets the terms of access and what options organisations have when those terms change. It also examines independent oversight, access to evidence and the ability to secure remedies when things go wrong.
Alongside this analysis, I develop original reference standards, governance tests and analytical frameworks for assessing control, traceability, accountability and resilience under real operating conditions. Written for sole traders, small businesses and larger organisations, these publications help owners and managers understand what to ask, why the answers matter and the consequences when protections are missing.
My research and reference work is published independently through Zenodo and other public repositories, where it is versioned, citable and open to scrutiny. I do not provide consultancy or advisory services.
Writing is my profession. Under the pen name Cecil Atley, I also write the Rhys Maren historical mysteries, which explore evidence, forgotten histories and the reconstruction of events from records left behind.
A public reference standard that defines AI governance as a measurable structural condition, moving beyond policy statements to test whether control, accountability, traceability and integrity can be demonstrated in practice across the AI lifecycle.
A quantitative AI governance metric designed to measure how much of an AI system remains provable when models, APIs, vendors or other upstream dependencies change. ERR focuses on traceability, reconstructability, version fidelity and dependency proof to assess whether governance can survive change.
The Business AI Governance Test is a practical YES/NO checklist designed to establish whether the protections surrounding a business's use of artificial intelligence can actually be demonstrated in practice rather than relying only on policies, contracts, provider claims or technical safeguards.
A practical governance test examining whether a business can maintain critical services if access to an external AI provider is suddenly restricted or withdrawn because of provider decisions, government action, sanctions, trade restrictions or geopolitical disruption.
A public reference framework for testing whether important AI protections actually work in practice, focusing on control, accountability, business dependence and effective oversight rather than relying on policies, promises or formal safeguards alone.
A practical business checklist examining why intervention in AI use may become necessary, what it is intended to protect and whether the organisation retains the authority, information and practical ability to act before consequences become unmanageable.
The Standardized Definition of AI Governance provides the foundation. It sets out what AI governance should mean in practice and how it can be tested, rather than relying only on policies, principles or statements of intent. Its focus is on whether control, accountability, human oversight, traceability and wider governance structures can actually be demonstrated.
The AI Protection Tests build on that foundation by asking whether important protections actually work in practice for the people and organisations affected by AI. They examine four areas: control for people who choose to use AI, accountability for people affected by AI they did not choose, business protection where organisations depend on AI providers, and effective independent oversight.
The Evidential Resilience Ratio (ERR), the External AI Withdrawal and Geopolitical Disruption Test and the Business Intervention Test then address three more specific areas that broader governance frameworks may leave to implementation.
ERR focuses on evidence and auditability: if the technology changes, can the organisation still prove what happened? The External AI Withdrawal and Geopolitical Disruption Test focuses on dependency and continuity: if an external AI service is restricted, withdrawn or becomes unavailable, can the organisation still operate?
The Business Intervention Test focuses on the practical ability to act: does the business know why intervention might become necessary, what it needs to protect and whether it could recognise the need and intervene in time? Its eleven questions examine whether that ability remains usable, including where action depends on a provider or could disrupt essential work.
Together, these five resources connect a common definition of AI governance with practical tests and measurements. They help organisations examine what their protections cover, what evidence supports them and where control, accountability or continuity may remain uncertain.